EUVD-2026-18410
GHSA-j222-qjwr-c34g
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the CVSS 4.0 vector indicating low impact (VC:L, VI:L, VA:L) with a score of 5.3, this vulnerability presents limited real-world risk due to multiple mitigating factors: the affected product has been discontinued and unsupported for over 14 years, making it unlikely to remain deployed in active networks; successful exploitation requires authenticated access (PR:L), eliminating unauthenticated remote attack; and the impact scope is limited to confidentiality, integrity, and availability on the local system only (SC:N, SI:N, SA:N). The EPSS exploitation probability (E:P) confirms publicly available proof-of-concept code exists. However, the combination of legacy product status, authentication requirement, and limited security boundaries means this represents a low-priority threat in modern network contexts. Organizations still operating this 2011-era router should prioritize upgrade over patch application. |
| Exploit ScenarioDerived | An authenticated user with access to the router's administrative interface (or an attacker who has obtained valid credentials through phishing, weak default passwords, or lateral movement) navigates to /setup.cgi and submits a crafted request to the vpn_connect function with a malicious policy_name parameter containing shell metacharacters (e.g., policy_name=test;id;). The unvalidated input is directly executed as a system command, allowing the attacker to enumerate users, extract configuration files, or modify routing rules. Publicly available exploit code on GitHub demonstrates this attack chain and has likely been integrated into automated vulnerability scanning tools. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Remote authenticated command injection in TrendNet TEW-657BRM 1.00.1 allows manipulation of the policy_name parameter in /setup.cgi vpn_connect function to achieve operating system command execution with limited impact. The affected router has been end-of-life since June 2011 and is no longer supported by the vendor; however, publicly available exploit code exists and the vulnerability demonstrates real command injection capability despite the legacy product status.
RemediationAI
No vendor-released patch identified at time of analysis, as the manufacturer discontinued the TEW-657BRM over 14 years ago and explicitly stated they cannot confirm or remediate vulnerabilities in this end-of-life product. Organizations operating this router should immediately plan its replacement with a current-generation supported model from TrendNet or an alternative vendor. If operational continuity is temporarily required, isolate the router to a dedicated network segment with strict access controls and disable remote management features. For detailed vulnerability context, refer to https://vuldb.com/vuln/354707 and the proof-of-concept documentation at https://github.com/panda666-888/vuls/blob/main/trendnet/tew-657brm/vpn_connect.md.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exploits improper input validation in the vpn_connect function of /setup.cgi on the TrendNet TEW-657BRM wireless router. The flaw is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that the application fails to sanitize or escape user-supplied input before passing it to system command execution routines. The policy_name parameter is directly concatenated into an OS command without proper validation, allowing an authenticated attacker to inject arbitrary shell metacharacters and commands. The CPE cpe:2.3:a:trendnet:tew-657brm indicates the specific vulnerable router model across all versions below 1.00.1.
Know when Tew 657Brm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in Trendnet TEW-657BRM 1.00.1. Affected by this vulnerability is the function vpn_connect of the file /setup.cgi. Executing a manipulation of the argument policy_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Trendnet TEW-657BRM Command Injection
View all 5More in Tew 657Brm
View allStack-based buffer overflow in Trendnet TEW-657BRM 1.00.1 wireless router allows authenticated remote attackers to achie
Stack-based buffer overflow in Trendnet TEW-657BRM router firmware 1.00.1 allows authenticated remote attackers to achie
Exploit-DB